CVE Program (CVE Services) API

Free CVE Program API with no key: fetch the authoritative CVE Record for any CVE ID in JSON 5.1 format, straight from the CVE Services registry. Tested example included.

No API key requiredCORS enabledHTTPSFree tier

Endpoint tested and returned HTTP 200 on 2026-08-21

What is the CVE Program (CVE Services) API?

The CVE Services API is the free, key-free read interface to the official CVE Record registry operated by the CVE Program. It returns the canonical JSON 5.1 record for any CVE ID, exactly as the assigning CNA published it, including descriptions, affected products, references and CVSS metrics.

This is the source of truth. Every other vulnerability feed — NVD, distribution trackers, commercial databases — starts from the record served here, then enriches or reformats it. Going direct means you see what the CNA actually wrote, without a downstream enrichment step's interpretation layered on top, and you see it immediately rather than after NVD's analysis queue.

The JSON 5.1 schema is the thing to understand. A record splits into `cveMetadata` and `containers`, and `containers.cna` is the assigning organisation's own account of the vulnerability. There may also be `containers.adp` entries — Authorized Data Publishers such as CISA adding exploitation status or extra CVSS scores. Because CNAs vary enormously in rigour, so does the data: some publish precise version ranges and CVSS vectors, others a paragraph of prose. Check `cveMetadata.state` too, since `REJECTED` records still resolve and returning a rejected CVE as a live finding is an embarrassing bug.

Quick facts

Base URL: https://cveawg.mitre.org/api
Authentication: No API key for reading CVE records. Write access, for CNAs publishing records, requires credentials and is out of scope here. CVE data is free to use under the CVE Program's terms of use, with attribution.
Rate limit: Generous and reported live: the example returned `RateLimit-Limit: 25000` on a 60-second window, with `RateLimit-Remaining` and `RateLimit-Reset` alongside it.
Pricing: Free. CVE Records are published for public use under the CVE Program terms.
CORS: Enabled — callable directly from browser JavaScript
Official docs: Read the docs

How to use the CVE Program (CVE Services) API

Every request below was executed against the live API on 2026-08-21, and the response shown is the real body it returned — not an illustration.

1. Fetch the official CVE record for Log4Shell

GET https://cveawg.mitre.org/api/cve/CVE-2021-44228

curl

curl 'https://cveawg.mitre.org/api/cve/CVE-2021-44228' \
  -H 'Accept: application/json'

JavaScript (fetch)

const res = await fetch("https://cveawg.mitre.org/api/cve/CVE-2021-44228", {
  headers: {
    "Accept": "application/json",
  },
});
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);

Python (requests)

import requests

headers = {
    "Accept": "application/json",
}

res = requests.get("https://cveawg.mitre.org/api/cve/CVE-2021-44228", headers=headers, timeout=20)
res.raise_for_status()
print(res.json())

Response — HTTP 200 (truncated)

{
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "cveMetadata": {
    "state": "PUBLISHED",
    "cveId": "CVE-2021-44228",
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "dateUpdated": "2025-10-21T23:25:23.121Z",
    "dateReserved": "2021-11-26T00:00:00.000Z",
    "datePublished": "2021-12-10T00:00:00.000Z"
  },
  "containers": {
    "cna": {
      "title": "Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints",
      "providerMetadata": {
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache",
        "dateUpdated": "2023-04-03T00:00:00.000Z"
      },
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects."
        }
      ],
      "affected": [
        {
          "vendor": "Apache Software Foundation",

Parameters

Parameter	Type	Required	Description
`cveId`	path segment	Required	The CVE identifier, including the `CVE-` prefix and year. `CVE-2021-44228`
`(endpoint) /cve-id`	path	Optional	Search CVE IDs by state, assigning CNA or time window rather than fetching one record. `/cve-id?state=PUBLISHED`
`(endpoint) /org`	path	Optional	List CNAs and look up which organisation assigns for a given product area. `/org`
`time_modified.gt`	query	Optional	On listing endpoints, return records modified after a timestamp — the basis for incremental syncing. `2026-08-01T00:00:00.000Z`

Response fields

cveMetadata.cveIdstring: The identifier, echoed back.
cveMetadata.statestring: `PUBLISHED`, `REJECTED` or `RESERVED`. Rejected records still resolve, so check this before treating one as a finding.
cveMetadata.assignerShortNamestring: Which CNA assigned and published the record — a strong signal of how detailed it will be.
cveMetadata.datePublished / dateUpdated / dateReservedstring: Lifecycle timestamps. The gap between reservation and publication can be months.
containers.cna.descriptions[]array: The CNA's own description, with a language tag. Free prose, not structured.
containers.cna.affected[]array: Affected vendors, products and version ranges. Structure and completeness vary by CNA.
containers.cna.metrics[]array: CVSS vectors as supplied by the CNA. Optional — many records have none.
containers.adp[]array: Additions from Authorized Data Publishers such as CISA, including exploitation status.

What you can build with the CVE Program (CVE Services) API

Pull the authoritative description and references for a CVE
Build a vulnerability tracker that does not depend on a single downstream feed
Compare a CNA's own CVSS score against NVD's analysis
Sync new and modified CVE records incrementally
Check whether a CVE has been rejected before acting on it

Common errors and how to fix them

404

The CVE ID does not exist or has never been published.

Fix: Reserved-but-unpublished IDs are common — a CVE can be cited in an advisory before its record goes live.

400

Malformed CVE ID.

Fix: The format is `CVE-YYYY-NNNN` with at least four digits in the sequence. Bare numbers are rejected.

Missing CVSS scores

The CNA did not supply metrics.

Fix: `metrics` is optional in the schema. Fall back to NVD's analysis, or to an ADP container, when the CNA left it empty.

Sparse affected-product data

CNA quality varies enormously.

Fix: Some CNAs publish exact version ranges; others give prose only. Do not build version-matching logic that assumes structured data is always present.

CVE Program (CVE Services) API — frequently asked questions

Is the CVE API free?

Yes, reading CVE records is free with no key or registration, and the rate limit is generous — 25,000 requests per minute in the run captured here. Write access is restricted to CNAs.

How is this different from the NVD API?

This serves the record exactly as the assigning CNA published it. NVD takes those records and adds its own analysis: CVSS scoring, CWE classification and CPE product matching. Records appear here first, sometimes days before NVD finishes enriching them.

What are the cna and adp containers?

`cna` is the assigning organisation's own account of the vulnerability. `adp` holds additions from Authorized Data Publishers such as CISA, which can attach exploitation status or supplementary scoring without changing the CNA's original text.

Why does a CVE I found have no CVSS score?

Because CVSS metrics are optional in the CVE record schema and many CNAs omit them. NVD supplies its own score for most published CVEs, so it is the usual fallback when the authoritative record has none.

Tools that pair with this API

JSON Formatter

Format, beautify and minify JSON online with 2-space, 4-space or tab indentation. Sort keys alphabetically and catch syntax errors instantly — free and private.

JSON Path Finder

Evaluate a dot/bracket path against your JSON and list every leaf path for discovery. Free online JSON path finder that runs 100% in your browser.

JSON to CSV Converter

Convert a JSON array of objects to CSV online. Automatic column headers from the union of all keys, delimiter choice and proper quoting — all in-browser.

CVE Program (CVE Services) is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 2026-08-21; always check the official documentation before relying on this API in production, as terms and limits can change.